Hot answers tagged

63

Having a proxy SSL certificate creates some privacy and security implications: Superfish can impersonate any site This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted. Certificate pinning does not protect you, ...


46

They might do it already, there is a known technique to dedicate malicious and powerful nodes to the network to be able to take control of some of the traffic. Tor does not advertise itself to be able to protect against adversaries that have control over a fair part of the internet. While there are techniques to check the validity of the nodes if you have ...


42

An encrypted connection is established first before any HTTP requests are performed (e.g. GET, POST, HEAD, etc.), but the hostname and port are visible. There are many other ways to detect which sites you’re visiting as well, for example: your DNS queries (i.e. they’ll see the IP request for secure.logmein.com) via network monitoring (e.g. ...


27

Normally, when HTTPS is done through a proxy, this is done with the CONNECT mechanism: the client talks to the proxy and asks it to provide a bidirectional tunnel for bytes with the target system. In that case, the certificate that the client sees is really from the server, not from the proxy. In that situation, the proxy is kept on the outside of the ...


26

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the ...


25

Simple Proxy Servers Even a simple proxy will see and log the names of the servers. For example visiting https://example.com/some/address.html will create a request like this from the browser to the proxy server: CONNECT example.org:443 HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:2.0b13pre) ... Proxy-Connection: keep-alive Host: example.org ...


24

It is possible, but it requires some setup. Here is how it is done, and how you can tell. On a corporate computer, where software updates are pushed from a central location, it is possible to send to your computer a "trusted" certificate that will be stored next to the trusted certificate of say, Verising or Entrust. Your company's proxy will hold the ...


20

As is customary, let's first answer the exact question which was asked. Right now, using HTTPS to connect to the proxy is not widely supported. The squid documentation has some information on the subject; to sum things up: Chrome supports it, but it must be configured through a proxy auto-configuration script because there is no GUI support. This also ...


19

Just because your traffic is passing though a proxy it doesn't mean you are safe. "Transparent" proxies will transmit your IP address using the X-Forwarded-For HTTP header. There are also cookies that can be used to identify you, such as flash's evercookie. You can even be fingerprinted and tracked by the extensions you have installed and what versions ...


18

With HTTPS, the SSL/TLS tunnel is established first, and HTTP traffic happens only within that tunnel. Some information still leaks: If the client uses a proxy, the connection to the proxy looks like: CONNECT www.example.com:443 with the target server name. Alternatively, the client could send the target server IP address, but this is only marginally less ...


17

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...


15

SOCKS itself does nothing to protect your data. It simply allows you to proxy your connections through another connection. The SSH connection from your local computer to the SSH server is what is giving you the security, because all traffic that goes through that connection (including your SOCKS traffic) is encrypted. So, any traffic going between the ...


14

From the source of https://www.dnsleaktest.com/: <iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe> ...


13

TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to interception device and interception device to server. This will still work with future TLS versions. TLS interception is only possible if the validation of the ...


12

TL;DR - I think your problem is not related to SSL at all, but you are trying to use a proxy server without the proxy headers. So, if I use stunnel to create an SSL tunnel, and then pass HTTP traffic through it, would it be the same as using HTTPS normally? Yes. We use http over stunnel at work to talk to an https-server. That's a workaround for a bug ...


12

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. <img src="http://123123.deanonymize.mydomain.com"/> ...


12

The way an investigator would trace a multi-hop connection to the original source is to follow each hop, and examine either the logs (if the connection is closed) or the network state (if the connection is ongoing) to see where the next hop goes. This can get very difficult if the hops cross political or jurisdictional borders, since the cooperation of ...


12

Here are a few risks that you expose yourself to with this specific software: It uses the same private key for each installation. Since the associated is a root CA and is inserted into your private trust list, it makes it trivial for ANYONE to generate any certificate and have it trusted by the affected client (in this case, even server certificate pinning ...


11

A proxy will by default tell the destination the IP address of the original requester by adding a X-Forwarded-For HTTP header to the original HTTP request. This make it obviously easy for the server, not only to know that you are using a proxy, but also to know your actual IP address, effectively dropping your anonymity. Then you have what is called an ...


10

Regarding industry accepted practices: (from http://www.rapid7.com/vulndb/lookup/sslv2-and-up-enabled) "SSLv2 has been deprecated and is no longer recommended. Note that neither SSLv2 nor SSLv3 meet the U.S. FIPS 140-2 standard, which governs cryptographic modules for use in federal information systems. Only the newer TLS (Transport Layer Security) ...


10

Following on Guillaume's answer (sorry, not enough reputation to comment), another way to check for foul play is to use the "Perspectives" Firefox add-on. When visiting an https site it checks (through Internet "notaries") that the public key you receive (via the web server certificate) does indeed belong to the site you're visiting.


10

For tracking what is sent and received, you can use a packet sniffer. I use Wireshark (formerly Ethereal).


10

I am going to assume you are talking about web browsers' private browsing feature. If that's not what you meant, please elaborate. Be warned that private browsing does not protect your anonymity. This is counter-intuitive, so let me explain. What private browsing does provide: Private browsing is designed to protect you against so-called "browser ...


10

If websense is configured to log it, then yes, they will be able to see where you went, all the URLs you visit. Content is less likely to be viewed - it depends on how websense/proxy is set up - but it can be done. It depends whether the SSL session is from your browser to the server or if it is just to the proxy (effectively running a man in the middle ...


10

Nope, the exit node can only decrypt the message and make the request, but he is not aware of where the original host is located, the only node that knows where the person is located is the second node. This is due to the layered encryption Tor uses. Every node only knows the next and previous hop, but not the whole path. Nope because of 1 Nope because of 1 ...


10

You are correct. Some ways for the site to decrease that attack vector would be to... Use an HSTS header to prevent any data from being sent to the site in plaintext. Advertise only the HTTPS URL and do not allow any plaintext connections. This will ensure most bookmarks use encryption. The point being that sites should force SSL from the beginning, ...


10

It's safe as long as you understand the implications. Fiddler acts as a proxy / man in the middle to intercept and decrypt traffic between you and the target. For SSL sites, it does this by dynamically generating an SSL certificate with the name of the target. The problem is that your browser will not trust certificates issued by Fiddler, hence the ...


10

There's a number of ways that you could achieve this As @raz says in comments use Tor. The Tor network is designed to anonymise Internet traffic so this would fit your bill quite well. Using something like Tails OS could be an easy way to get started for you in that line. As @zviad-gabroshvili says use a proxy. there are a wide range of proxy services ...



Only top voted, non community-wiki answers of a minimum length are eligible